Analysis
-
max time kernel
119s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 12:28
Static task
static1
Behavioral task
behavioral1
Sample
ff46f0bdebe2303371df5056650b193b_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ff46f0bdebe2303371df5056650b193b_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
ff46f0bdebe2303371df5056650b193b_JaffaCakes118.html
-
Size
24KB
-
MD5
ff46f0bdebe2303371df5056650b193b
-
SHA1
fccbe0d50ea38881cb7cc1d2a3ef220a31f40bec
-
SHA256
a6c208cf8fe68a512ea9206bfe8ffe0227a9f8bf7d653243355497143c0285d2
-
SHA512
b6b6996958366658519d8cd00212961d46b0a68f6d8df7e2149e22fe3e4114bc797ab8b906237c8f4baf2aeb868d624b1d1e128dc444d9e7a3cc2dc7f74b8301
-
SSDEEP
192:uwX0b5nJu/4nQjxn5Q/dnQiegNn7nQOkEnt3PfnQTbnxnQTGLnLnQtuqMBAqnYnn:1Q/DGnmv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B666FC21-FFDA-11EE-BEA9-FE29290FA5F9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419864412" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000324cd6e1ca09404b84bf490409ed6dc400000000020000000000106600000001000020000000d0efad23395d9fe6176aa894daabff5a08d1f0a1461f673d38d133475fa96f7d000000000e80000000020000200000003644008ed44007fada3041d4b25d8304c487811809663d001bdcff32d0e08f0590000000621d6dd9ba204898e2c188cefc737d0802baafd45ee1bd6aded1f387a54ca101521fd37646de1c18951533a3213a42f3abc08632b7df8bfa8d124dfd3bcb82e90bcad01e3cd57bdd36ae2ebb85b3b84690cc8a2794de28e671247f5fef522ba69f31478aefa8e029b67825186120670eaed5b34116ded53d3da2468c294b9a96b6a1de6d3fabe94c4834aee322767217400000006f3aad68bc08354c7e585341d99653299b5f1dc12c2c7f68851849a22819fa2a3fcbb4fe87738c9f87adc19ac83aa5f32a6346950a339fb68db841437d6a0263 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000324cd6e1ca09404b84bf490409ed6dc400000000020000000000106600000001000020000000491d296e9e4ab4872578f6eb5c68f1e6c74cd307ca8b819713c760d546505b97000000000e80000000020000200000003bf6466bb82b61ac2324a4dd1430afdc6a40138e6401b15cab0cb88404af811620000000e76d93513e9f6c4ee8d7892894711cf3af070f46a2c871658510a1668e9b610d4000000039fd223c63737fd70c3f133947574d5862a5a3a45f1951e5afe66bf675f0f922b8e4cc8f95ca803a65d5f8577cbe59fbb2e495b3901cd024587e5e75267a43f3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0018288be793da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2196 2172 iexplore.exe 28 PID 2172 wrote to memory of 2196 2172 iexplore.exe 28 PID 2172 wrote to memory of 2196 2172 iexplore.exe 28 PID 2172 wrote to memory of 2196 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff46f0bdebe2303371df5056650b193b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5c4d84e814bf2000cbe543178dc325c31
SHA156c7351a31d5485a7865f5e78a86a6d939df341f
SHA25635cf167ddd1137d2af2436a800a19932565405a6ebc83633ee8adfa4bb6c3115
SHA5123f7fb9ef4df8b7969fb8ed2132d360f816fba07f432f87a2b71eb9a8fb56232841a84b459107722402668f1100b136bff08e575266eb53e9de8a63e2b2d43f04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdc0b0711c3e8777ddf683ff19b28958
SHA13cb1a026f186b8398ec8b092ff0a63a6272afe24
SHA2567f465480de50c68ded62985debc6131a428461229f03174ce1ccc59aa5caac4c
SHA5122bf4239af4c9b6929bc51a7708c2ecbffb2dc4700f772f5c5738738eab866c39738fe8ff6b908de51f19d0095991edc0f1568eddb365a6495affbc8ea3b0779f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aeb3c703b1f875d85edd2be1cbc1d51
SHA1b747937a025c74ad58087969ec9c0c81fbe71795
SHA25683ce0869f20e2859945d054b76b354cd931afabdb7b43bbbd3f1229ba546b292
SHA512e318e57d9e6bf6f3e1b76de3b2aa2cf7b30ae16f32f1e4bbb1b29106459ff9e74348b30bc982d0b8fb356bd7f5a8865e3c1b2a7c2a88a6115c2958d160955073
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1e8b66a50f951856fe001357cf7abd9
SHA1ed84c8298df1718e021022d966641e204707c91a
SHA2560bb51a13b5164da6e8c93198f7300dd76bc7fe5cbe4bb1f413c531debe4e1bf3
SHA5120cb7fd2d368b5e6558ea1f7ec9e344255e1af05d576cdd81afce76c55d4d3fa641c87ff878dda0f9b6773b70c42d5866f022a259d1a008733ebd73992dba3cd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dedc3e169caf20577a9f9975aef14c2c
SHA18299238543948b7e9c569dd4777b60629d9a35c6
SHA25604bd69ad361df6acefe0b0e90753366febec767ad7ca9848b6719dd69df7e4e9
SHA512ea20c1d7c34d1b61ded2b9520bc74ecddc6261a2f0a19c33be5f8498cd37cf212feaba0de4f6b19540e83f4cc5e57471eb68763eea244740e875d7530c0c16d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec71eec7290fc1490a392d1b72ba5b36
SHA13f1c89b5d22a2f3b1490d8c99b17f0dc4ef48152
SHA256b16abf951ccca3f047da7970313f6ce25701b3ee6198d086f0a0399343e71220
SHA512b8e792e6b8ac2b9e3e78e46183d53a06c3038faca0709ca04de26f1397110c974f0374446a0ecbaac4be941935d8b41321bbed18e1b1b1dcb076f4ea30cd6e2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb40177044c6aba1a7b2a1a6182009b3
SHA1863e5a8b1c6c042d3f7331c4c3a7311e7f67139f
SHA256127e7ef93fdf18934dccc2ee5883ecea5104594180817c63b23a242730278189
SHA512ff2d3299b83e22c07fbb9f94a2942fe868fda4f143d468f87326a845366019f9e75adde9279c98a372e7385a3649ab6a6018dd3113fd840dec64312eeae88ef2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510ddba26ee9c08e0ee758e29f088351c
SHA192dc406af30d68273d3deae72ff3e8f4bddc6df1
SHA256fdca5a0f82c41a4d3e67c5b3ea956e3d8cf7584fc61bf618307c7efe95de94a1
SHA5126948c1d6f397c8c253e8721d80ebd8959da390924ce9f6ed0801053ce670894c6abbeafb54eea3f6ebe5b0d969886bd8bbd8f966b3b791c3d385b5e6d7d60dbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e561da1707e29fac8e181571d4fbbc07
SHA1c4a5a78c007941ced7564993112d02b070c9e3af
SHA2561c4f4f7c0f503491e69d3a85214c924e7f2b2d8cc5999d0b8d4235b327550a4b
SHA512beda94598eb79b7446ae6d3e63730c7d88b7cb949d6b725a3caff7a65089ce47c405aa92d943fe8bb86cfa3bc8d1e54f2cf5865ae422f34e404ffbfc345a7c83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53654b3ecea64c304ef661b968adc34e8
SHA1ec6d98caeea56fc3275ad9618bb1c6034474cbaf
SHA256a98f1690341fdb6c3a1f14661b115908a8a7defd169745915e2c118ea50c6cce
SHA51260910331be464179ea27cdc7319d6ee25ea17d4d89728d45b5ae41cd8e566f9af6272703e9a0ff24a9f803d623ce916a4aa9a68b61239d6e0d864abd5e6f79c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520ec2488ddc4e229f4575331715bd169
SHA1c337ded932a133031ee688a333f3704a1b66ca85
SHA256859e23fbe353914bda8b998555c6526d53f0de62456bfbf19ce301c8c51394cf
SHA51211858ec791ceafb6bb1c4a49cc209c81b2c33a8f4e868b07d8ac662ddc436904e0b98cf6e1b407a684c004d02cc262852ec36a3e3f9e3790fc296f5d5b1d869e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD588ebe92d7780b46de7aa1a83201bc7f4
SHA175db445c8ee8a663e44102c1e5e81f200f8d1354
SHA256ca5d3f69e80c20f4d75e507e6092fb0afb9602aa49c90e99ef3042c9597df271
SHA512162210f3081e6930725fb436e6d54bc0fa56ea35835ad147428041d1d5dfbad788e2463427424622857b67e0e8fc691c15b79c02ef938ae568fea2cff7db766c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a